Trojan_BAT_Mardom_YZAA_MTB

YARA detection rule by roadwy

Trojan:BAT/Mardom.YZAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00

rule Trojan_BAT_Mardom_YZAA_MTB{
	meta:
		description = "Trojan:BAT/Mardom.YZAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 "
		
	strings :
		$a_03_0 = {02 25 17 58 10 00 91 7e 64 02 00 04 02 25 17 58 10 00 91 1e 62 60 7e 64 02 00 04 02 25 17 58 10 00 91 1f 10 62 60 7e 64 02 00 04 02 25 17 58 10 00 91 1f 18 62 60 13 04 7e 64 02 00 04 02 25 17 58 10 00 91 7e 64 02 00 04 02 25 17 58 10 00 91 1e 62 60 7e 64 02 00 04 02 25 17 58 10 00 91 1f 10 62 60 7e 64 02 00 04 02 25 17 58 10 00 91 1f 18 62 60 13 05 d0 07 00 00 1b 28 ?? 00 00 0a 6f e7 02 00 0a 11 05 28 ?? 02 00 0a 13 06 7e 64 02 00 04 02 11 06 16 11 04 1a 59 28 ?? 00 00 0a 11 06 a5 07 00 00 1b 0b 0f 00 28 ?? 02 00 0a 10 02 07 2a } 		$a_01_1 = {76 51 55 6e 70 7a 79 55 64 52 79 5a 64 78 78 42 54 6d 46 70 7a 5a 54 7a 47 44 6a 64 69 59 71 48 58 4a 43 46 73 45 77 6c 69 6f 6c 53 6b 4d 5a 47 52 77 53 77 61 73 46 57 77 56 68 6c 51 56 6d 46 62 72 42 55 75 73 } 		$a_01_2 = {4c 54 58 54 56 76 57 58 77 59 51 74 66 4d 43 46 71 53 58 69 45 74 57 6c 67 59 4d 50 4c 4b 58 6f 49 74 } 		$a_01_3 = {51 7a 49 4c 4f 4d 48 69 77 45 49 58 4a 50 62 6e 66 6a 75 71 59 4a 50 58 72 6d 66 51 45 4c 72 4a 57 59 4d 55 63 4c 7a 74 45 62 5a 69 66 6e 70 78 64 74 41 49 66 4a 72 47 6a 6b 55 63 68 71 64 6c 4d 79 42 6b 43 48 4c 55 6b 42 6d 78 6a 68 73 45 77 68 6e 4c 4b 6a 65 4d 67 46 6b 72 } 	condition:
		((#a_03_0  & 1)*3+(#a_01_1  & 1)*1+(#a_01_2  & 1)*1+(#a_01_3  & 1)*1) >=6
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a2925cff-598c-47b6-a321-0159c427e020

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion